4.2 Configure Exceptions and Exclusions XDR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In which scenario is it most appropriate to use an exception in XDR?

   • AWhen a network path is known to be slow and causes performance issues.
   • BWhen a new malware signature is released and needs to be tested.
   • CWhen an endpoint is suspected of being compromised and needs immediate isolation.
   • DWhen a known internal tool generates a detection that is confirmed to be benign.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is considering adding an exclusion for a specific application to reduce false positives. What is the most important impact the analyst should consider before implementing this exclusion?

   • AThe exclusion will prevent the application's events from being processed, which could hide malicious activity that mimics the application's behavior.
   • BThe exclusion will automatically be applied to all other applications with similar names.
   • CThe exclusion will increase the processing load on the XDR system because it needs to check the exclusion list for every event.
   • DThe exclusion will only suppress alerts, leaving the events available for future investigation.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why is it important to periodically review and update exceptions and exclusions in XDR?

   • ATo delete all historical detection data from the system.
   • BTo ensure they remain valid as the environment, threats, and business requirements change.
   • CTo increase the number of alerts generated by the system.
   • DTo ensure that all endpoints are excluded from detection processing.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In Palo Alto Networks XDR, what is the key functional difference between an exception and an exclusion?

   • AAn exception is permanent, while an exclusion is temporary by default.
   • BAn exception applies only to Cortex XDR agents, while an exclusion applies only to firewall logs.
   • CAn exception removes data from storage, while an exclusion only hides alerts from the UI.
   • DAn exception suppresses alerts for matching detections, while an exclusion prevents data from being processed by detection logic.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a valid use case for configuring an exception in XDR?

   • AA new employee who needs access to sensitive data.
   • BA critical server that should be monitored more closely than others.
   • CA network segment that is being decommissioned.
   • DA security scanner that regularly triggers a detection but is verified as safe.
   Reveal Solution Discussion Select an answer first